Introduction to threat hunting: hypothesis, data, ATT&CK
You learn to look for attacker traces without waiting for an alert: you form a hypothesis, choose the data to examine, interpret the results and turn findings into new detections.
Level 201 · 15 lessons · 15 practice labs
Lessons
What hunting is
- Hunting versus monitoring
- The hunt loop: hypothesis, investigation, result, improvement
- Writing a good hypothesis
- Which data you need: a data source checklist
- Short task: derive three hunting hypotheses from a threat report
Techniques
- Stacking: finding what is rare
- Baselining: knowing what a normal day looks like
- Grouping and clustering
- Pivoting from one lead to the next
- Short task: find the service running on only one of all hosts
Concluding
- Documenting the hunt: what you found and what you didn’t
- From a hunt to a lasting detection
- When a finding becomes an incident: handing it over
- Measuring the hunt programme: time, findings, new rules
- Capstone: run a hunt from one hypothesis to the end and report it
Practice labs
- Write a testable hunting hypothesis from a threat report: Choose one technique in the report and form a one-sentence hypothesis saying which trace you will look for in which data.
- Tick the data sources this hypothesis needs: Match three given hypotheses with sources on the checklist and point out the one that is missing.
- Turn a vague hypothesis into a measurable one: Turn a general idea like something bad is on the network into a hypothesis with technique, data and success criteria and run the first query.
- Draw a new lead from a disproved hypothesis: Re-examine the data of a hunt that found nothing, find an unexpected pattern and form a second hypothesis.
- Find the process running on only one of all hosts: Count process names by number of hosts and write down the rarest with its path.
- Stack the least common User-Agent values: Count User-Agents in proxy records and find the unusual value coming from a single host.
- Build a normal-day baseline and find the outlier: Derive each user’s usual range from a week of logon times and show the logon outside it.
- Cluster scheduled tasks by their command: Group similar commands and find the task that stands alone and which host it is on.
- Complete the chain by pivoting from one lead to the next: Start from a rare domain, pivot to host, process and user, and record the query for each step.
- Document the hunt result in a short record: Write the hypothesis, the data examined, what was found and what was not under four headings.
- Turn a hunt finding into a lasting detection rule: Reduce the noise of the query you used in the hunt, turn it into a scheduled rule and test it on past data.
- Decide whether a finding counts as an incident: Compare the evidence with the incident criteria and write the handover note or justify closing it.
- Measure three months of the hunt programme’s output: Calculate time spent, findings and rules produced from the hunt records and identify the least productive hunt type.
- Reduce command lines to patterns and surface the rare clusters: Write a script that replaces paths, numbers and identifiers with placeholders in ten thousand command lines, count the patterns and review clusters seen on fewer than five hosts.
- Turn a hunt with no findings into a detection rule and a data request: Record the hypothesis, the data examined and what you could not see, turn the useful query into a rule and write a justified request for the missing log source.
About this course
You learn to look for attacker traces without waiting for an alert: you form a hypothesis, choose the data to examine, interpret the results and turn findings into new detections.
What you will learn
- What hunting is
- Techniques
- Concluding
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.